1018 matches found
CVE-2020-7210
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...
CVE-2020-7210
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...
CVE-2020-7210
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...
CVE-2020-7210
CVE-2020-7210 affects Umbraco CMS 8.2.2, where a CSRF flaw allows an attacker to enable/disable or delete user accounts. The Red Hat, GHSA, NVD, and Snyk records confirm the same issue across multiple mappings; exploit details are not provided beyond the CSRF risk. The practical impact is the man...
Umbraco CMS 8.2.2 Cross Site Request Forgery
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Cross-Site Request Forgery CSRF product: Umbraco CMS vulnerable version: version 8.2.2 fixed version: version 8.5 CVE number: CVE-2020-7210 impact: medium homepage:...
CVE-2020-7210: Cross-Site Request Forgery (CSRF)
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...
PT-2019-6207
Name of the Vulnerable Software and Affected Versions Umbraco CMS version 8.2.2 Description The issue is related to a cross-site request forgery CSRF flaw. This flaw can be exploited by a remote attacker using a specially crafted web page to enable, disable, or delete user accounts. Recommendatio...
CVE-2019-13957
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...
CVE-2019-13957
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...
Sql injection
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...
CVE-2019-13957
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...
CVE-2019-13957
CVE-2019-13957 affects Umbraco 7.3.8 with a SQL Injection vulnerability in the backoffice /PageWApprove/PageWApproveApi/GetInpectSearch endpoint via the nodeName parameter. The NVD entry lists high/critical impact metrics (CVSS v2 base score 7.5; CVSS v3.1 base score 9.8) indicating network attac...
CVE-2019-13957
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...
PT-2019-13494
Name of the Vulnerable Software and Affected Versions Umbraco version 7.3.8 Description The issue concerns SQL Injection in the backoffice, specifically in the GetInpectSearch method of PageWApproveApi. This occurs via the nodeName parameter. Recommendations For Umbraco version 7.3.8, consider...
CVE-2019-13957: Improper Neutralization of Special Elements used in an SQL Command
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...
Cross-site Scripting (XSS)
umbraco cms is vulnerable to cross-site scripting. A remotely authenticated attacker is able to inject arbitrary Javascript into a victim's browser via the Header Name when updating or removing public access of content...
Remote Code Execution (RCE)
umbraco is vulnerable to remote code execution RCE. Upload of .php files are not blocked in Umbraco.Web.UI/config/umbracoSettings.Release.config, which would allow an attacker to upload .php files containing malicious code, which will be executed when browsing to the file...
Cross-site Scripting (XSS)
umbraco cms is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the nodename parameter during the creation of a new page related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...
XML External Entity (XXE)
umbraco cms is vulnerable to XML external entity XXE attacks. Lack of validation and permitting of external DTDs allow attackers to obtain confidential information via an SSRF from the XXE attack...
Umbraco CMS 7.12.4 Remote Code Execution
Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4 Category: Webapps Tested...